Security: aio-libs/aiohttp
Security Advisories
View known security vulnerabilities and report new vulnerabilities privately to maintainers.
-
Out-of-bounds heap read in C HTTP response parser may lead to DoSGHSA-cq5v-8q36-5273 published
Jul 25, 2026 by DreamsorcererHigh -
HTTP request smuggling via WebSocket upgradeGHSA-mfx4-hv73-q22v published
Jul 26, 2026 by DreamsorcererLow -
WebSocket client accepts compressed frames without negotiated permessage-deflateGHSA-mq44-7p77-q5h7 published
Jul 26, 2026 by DreamsorcererLow -
Incomplete websocket frame payloads bypass memory limitsGHSA-xcgm-r5h9-7989 published
Jun 8, 2026 by DreamsorcererModerate -
TLS Server Hostname Override Is Ignored When Reusing HTTPS ConnectionsGHSA-4m7w-qmgq-4wj5 published
Jun 8, 2026 by DreamsorcererLow -
Payload Response Resources Are Not Closed After Mid-Body DisconnectGHSA-9x8q-7h8h-wcw9 published
Jun 8, 2026 by DreamsorcererLow -
HTTP/1 Pipelined Requests Queue Without LimitGHSA-4fvr-rgm6-gqmc published
Jun 8, 2026 by DreamsorcererModerate -
Unread Compressed Request Bodies Bypass client_max_size During CleanupGHSA-g3cq-j2xw-wf74 published
Jun 8, 2026 by DreamsorcererModerate -
C HTTP Parser Bypasses max_line_size for Fragmented LinesGHSA-63hw-fmq6-xxg2 published
Jun 8, 2026 by DreamsorcererModerate -
DigestAuthMiddleware Applies Credentials to Cross-Origin Redirect ChallengesGHSA-hpj7-wq8m-9hgp published
Jun 8, 2026 by DreamsorcererLow